enforce signed revocation history and cross-client manifest v5 (v5.2.32)

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "5.2.31",3+  "version": "5.2.32",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -12,6 +12,7 @@1212 const androidCoordinator = readFileSync(resolve(androidRoot, "app/src/main/java/com/peachpasswords/sync/SyncCoordinator.kt"), "utf8");1313 const browserSyncTypes = readFileSync(resolve(browserRoot, "src/shared/sync-types.ts"), "utf8");1414 const androidManifest = readFileSync(resolve(androidRoot, "app/src/main/java/com/peachpasswords/sync/DeviceManifestSupport.kt"), "utf8");15+const androidSyncMessage = readFileSync(resolve(androidRoot, "app/src/main/java/com/peachpasswords/sync/SyncMessage.kt"), "utf8");1516 const browserPairedDevices = readFileSync(resolve(browserRoot, "src/background/paired-devices.ts"), "utf8");1617 const androidPairedDevices = readFileSync(resolve(androidRoot, "app/src/main/java/com/peachpasswords/sync/PairedDeviceStore.kt"), "utf8");1718 @@ -21,11 +22,22 @@2122 if (!browserCoordinator.includes("helloIn.deviceManifestVersion === DEVICE_MANIFEST_VERSION")) throw new Error("Browser does not negotiate device manifests from SYNC_HELLO");2223 if (!androidCoordinator.includes("val exchangeDeviceManifest = vault.negotiatesDeviceManifest(hello)")) throw new Error("Android does not negotiate device manifests from SYNC_HELLO");2324 if (!androidCoordinator.includes("peerVersion == DEVICE_MANIFEST_VERSION")) throw new Error("Android does not require an exact device-manifest version match");24-if (!browserSyncTypes.includes("DEVICE_MANIFEST_VERSION = 0x04") || !androidManifest.includes("DEVICE_MANIFEST_VERSION = 0x04")) throw new Error("Browser and Android device-manifest versions differ");25+26+const manifestVersion = (source, declaration) => {27+  const match = source.match(new RegExp(`${declaration}\\s*=\\s*(0x[0-9a-f]+|\\d+)`));28+  if (!match) throw new Error(`Missing ${declaration} declaration`);29+  return Number(match[1]);30+};31+if (manifestVersion(browserSyncTypes, "DEVICE_MANIFEST_VERSION") !== manifestVersion(androidManifest, "DEVICE_MANIFEST_VERSION")) {32+  throw new Error("Browser and Android device-manifest versions differ");33+}34+if (!browserSyncTypes.includes("issuerSigningPublicKeyHex") || !browserSyncTypes.includes("signatureHex") ||35+    !androidSyncMessage.includes("issuerSigningKeyHex") || !androidSyncMessage.includes("signatureHex")) {36+  throw new Error("A client lacks signed revocation fields");37+}2538 if (!browserPairedDevices.includes("MAX_REVOCATIONS = 500") || !androidPairedDevices.includes("MAX_REVOCATION_RECORDS = 500")) throw new Error("Browser and Android revocation ledger caps differ");2639 if (!browserPairedDevices.includes("enqueueDeviceMutation") || !androidPairedDevices.includes("RegistryMutationGate")) throw new Error("A paired-device registry lacks whole-list mutation serialization");2740 if (!browserPairedDevices.includes("function capRevocations") || !androidPairedDevices.includes("fun capRevocationRecords")) throw new Error("A client lacks largest-issuer-first revocation retention");28-2941 const browserEndpoint = String.raw`3042 import { createInterface } from "node:readline";3143 import { createServer, createConnection } from "node:net";

@@ -52,17 +52,22 @@5252   });5353 5454   it("fresh_install_writes_id_to_local_only", async () => {55+    const vault = await import("./vault");56+    await vault.createVault("identity-test-password");5557     const { getOrCreateDeviceId } = await import("./device-identity");5658 5759     const id = await getOrCreateDeviceId();5860 5961     expect(typeof id).toBe("string");6062     expect(id.length).toBeGreaterThan(0);61-    expect(local[DEVICE_ID_KEY]).toBe(id);63+    expect(local[DEVICE_ID_KEY]).toBeUndefined();64+    expect(local["peach_local_identity_v2"]).toBeDefined();6265     expect(syncSet).not.toHaveBeenCalled();6366   });6467 6568   it("returns_a_stable_id_across_calls", async () => {69+    const vault = await import("./vault");70+    await vault.createVault("identity-test-password");6671     const { getOrCreateDeviceId } = await import("./device-identity");6772 6873     const first = await getOrCreateDeviceId();@@ -72,13 +77,15 @@7277   });7378 7479   it("replaces_a_copied_local_id_when_adoption_reports_a_collision", async () => {75-    local[DEVICE_ID_KEY] = "copied-browser-id";80+    const vault = await import("./vault");81+    await vault.createVault("identity-test-password");7682     const { getOrCreateDeviceId, rotateDeviceId } = await import("./device-identity");7783 84+    const original = await getOrCreateDeviceId();7885     const fresh = await rotateDeviceId();7986 80-    expect(fresh).not.toBe("copied-browser-id");81-    expect(local[DEVICE_ID_KEY]).toBe(fresh);87+    expect(fresh).not.toBe(original);88+    expect(local["peach_local_identity_v2"]).toBeDefined();8289     expect(await getOrCreateDeviceId()).toBe(fresh);8390     expect(syncSet).not.toHaveBeenCalled();8491   });

@@ -1,31 +1,30 @@1-// Local-device identity helpers for the sync architecture.2-//3-// `deviceId` is a stable UUID v4 generated on first call and persisted in4-// `chrome.storage.local`. It is deliberately device-local and must NOT roam:5-// it is the only symmetry-breaker in the sync-identity HKDF (see PCH-01-004),6-// so a shared id across profiles would collide derived sync keys.7-//8-// `deviceName` defaults to a short, friendly browser+OS description and9-// can be overridden by the user from Settings → Sync.10-//11-// The local sync identity itself is derived deterministically from the12-// vault master key (`deriveSyncIdentityKeypair`); the function below is a13-// thin coordinator that pulls the master key out of `vault.ts` and exposes14-// only the public half to callers that don't need to sign.1+// Local-device identity helpers. Cryptographic credentials are generated once2+// per installation and kept in an encrypted local record; vault unlock is the3+// only way to hydrate the operational cache.154 5+import { generateKeyPairFromSeed } from "@stablelib/x25519";166 import {177   computeVaultId,18-  deriveSyncIdentityKeypair,19-  deriveSyncSigningKeypair,208   pubkeyToHex,219 } from "../shared/sync-identity";2210 import type { LocalIdentity } from "../shared/pairing-handshake";2311 import type { DeviceType } from "../shared/sync-types";12+import { decrypt, encrypt } from "./aes";2413 import { getRootKeyHex, isUnlocked } from "./vault";2514 26-const DEVICE_ID_KEY = "peach_device_id";2715 const DEVICE_NAME_KEY = "peach_device_name";16+const IDENTITY_RECORD_KEY = "peach_local_identity_v2";17+const IDENTITY_INFO = "peach-local-identity-v2";2818 19+interface IdentityRecord {20+  v: 2;21+  deviceId: string;22+  x25519PrivateKeyHex: string;23+  ed25519SeedHex: string;24+}25+26+let cached: IdentityRecord | null = null;27+2928 export interface LocalDeviceIdentity {3029   deviceId: string;3130   deviceName: string;@@ -34,70 +33,111 @@3433   signingPublicKeyHex: string;3534 }3635 37-export async function getOrCreateDeviceId(): Promise<string> {38-  // PCH-01-004: deviceId is the ONLY symmetry-breaker in the sync-identity HKDF39-  // (sync-identity.ts:54). It must NOT roam across profiles via chrome.storage.sync,40-  // or two profiles on the same browser account sharing a vault derive identical41-  // static + signing keys and collide in the device graph. Keep it device-local.42-  const local = await chrome.storage.local.get(DEVICE_ID_KEY);43-  const localId = (local as Record<string, unknown>)[DEVICE_ID_KEY];44-  if (typeof localId === "string" && localId.length > 0) return localId;45-46-  const fresh = generateUuidV4();47-  await chrome.storage.local.set({ [DEVICE_ID_KEY]: fresh });48-  return fresh;36+function hex(bytes: Uint8Array): string {37+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");4938 }39+function bytes(value: string): Uint8Array {40+  if (!/^[0-9a-f]{64}$/i.test(value)) throw new Error("identity_migration_required");41+  const out = new Uint8Array(32);42+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(value.slice(i * 2, i * 2 + 2), 16);43+  return out;44+}45+async function loadRecord(root: Uint8Array): Promise<IdentityRecord | null> {46+  if (cached) return cached;47+  const row = (await chrome.storage.local.get(IDENTITY_RECORD_KEY))[IDENTITY_RECORD_KEY] as Record<string, unknown> | undefined;48+  if (!row) return null;49+  if (row.v !== 2 || typeof row.nonce !== "string" || typeof row.ciphertext !== "string" || typeof row.tag !== "string") {50+    throw new Error("identity_migration_required");51+  }52+  let parsed: IdentityRecord;53+  try {54+    parsed = JSON.parse(await decrypt(root, row.nonce, row.ciphertext, row.tag, IDENTITY_INFO)) as IdentityRecord;55+  } catch { throw new Error("identity_migration_required"); }56+  if (57+    parsed.v !== 2 ||58+    !/^[0-9a-f]{64}$/i.test(parsed.x25519PrivateKeyHex) ||59+    !/^[0-9a-f]{64}$/i.test(parsed.ed25519SeedHex)60+  ) throw new Error("identity_migration_required");61+  cached = parsed;62+  return parsed;63+}64+async function ensureRecord(root: Uint8Array): Promise<IdentityRecord> {65+  const existing = await loadRecord(root);66+  if (existing) return existing;67+  const x = new Uint8Array(32); const ed = new Uint8Array(32);68+  crypto.getRandomValues(x); crypto.getRandomValues(ed);69+  const record: IdentityRecord = { v: 2, deviceId: generateUuidV4(), x25519PrivateKeyHex: hex(x), ed25519SeedHex: hex(ed) };70+  const sealed = await encrypt(root, JSON.stringify(record), IDENTITY_INFO);71+  await chrome.storage.local.set({ [IDENTITY_RECORD_KEY]: { v: 2, ...sealed } });72+  x.fill(0); ed.fill(0); cached = record;73+  return record;74+}5075 51-/** Replace a copied profile identity after an authenticated peer detects a collision. */76+export async function getOrCreateDeviceId(): Promise<string> {77+  if (!isUnlocked()) throw new Error("vault_locked");78+  const rootHex = getRootKeyHex(); if (!rootHex) throw new Error("vault_locked");79+  return (await ensureRecord(bytes(rootHex))).deviceId;80+}5281 export async function rotateDeviceId(): Promise<string> {53-  const fresh = generateUuidV4();54-  await chrome.storage.local.set({ [DEVICE_ID_KEY]: fresh });55-  return fresh;82+  if (!isUnlocked()) throw new Error("vault_locked");83+  const rootHex = getRootKeyHex();84+  if (!rootHex) throw new Error("vault_locked");85+  const root = bytes(rootHex);86+  const x = new Uint8Array(32);87+  const ed = new Uint8Array(32);88+  try {89+    crypto.getRandomValues(x);90+    crypto.getRandomValues(ed);91+    const record: IdentityRecord = {92+      v: 2,93+      deviceId: generateUuidV4(),94+      x25519PrivateKeyHex: hex(x),95+      ed25519SeedHex: hex(ed),96+    };97+    const sealed = await encrypt(root, JSON.stringify(record), IDENTITY_INFO);98+    await chrome.storage.local.set({ [IDENTITY_RECORD_KEY]: { v: 2, ...sealed } });99+    cached = record;100+    return record.deviceId;101+  } finally {102+    root.fill(0);103+    x.fill(0);104+    ed.fill(0);105+  }56106 }57-58107 export async function getDeviceName(): Promise<string> {59108   const result = await chrome.storage.sync.get(DEVICE_NAME_KEY);60109   const stored = (result as Record<string, unknown>)[DEVICE_NAME_KEY];61-  if (typeof stored === "string" && stored.length > 0) return stored;62-  return defaultDeviceName();110+  return typeof stored === "string" && stored.length > 0 ? stored : defaultDeviceName();63111 }64-65112 export async function setDeviceName(name: string): Promise<void> {66113   const trimmed = name.trim();67114   if (!trimmed) throw new Error("device name must not be empty");68115   if (trimmed.length > 64) throw new Error("device name must be 64 chars or fewer");69116   await chrome.storage.sync.set({ [DEVICE_NAME_KEY]: trimmed });70117 }71-72-/**73- * Build the public-facing identity record for the local extension. The74- * private key half (used only for ongoing Noise KK sessions) is not75- * exposed by this function — Phase-1 pairing uses ephemeral keys only.76- */77-export async function buildLocalIdentity(78-  masterKey: Uint8Array,79-): Promise<LocalDeviceIdentity> {80-  const deviceId = await getOrCreateDeviceId();81-  const deviceName = await getDeviceName();82-  const kp = deriveSyncIdentityKeypair(masterKey, deviceId);83-  const signing = await deriveSyncSigningKeypair(masterKey, deviceId);84-  return {85-    deviceId,86-    deviceName,87-    deviceType: "extension",88-    longTermPublicKeyHex: pubkeyToHex(kp.publicKey),89-    signingPublicKeyHex: pubkeyToHex(signing.publicKeyRaw),90-  };118+export async function buildLocalIdentity(masterKey: Uint8Array): Promise<LocalDeviceIdentity> {119+  const record = await ensureRecord(masterKey);120+  const x = bytes(record.x25519PrivateKeyHex);121+  const kp = generateKeyPairFromSeed(x);122+  const signingPrivateKey = await importSigningKey(bytes(record.ed25519SeedHex));123+  const jwk = await crypto.subtle.exportKey("jwk", signingPrivateKey) as JsonWebKey;124+  return { deviceId: record.deviceId, deviceName: await getDeviceName(), deviceType: "extension",125+    longTermPublicKeyHex: pubkeyToHex(kp.publicKey), signingPublicKeyHex: base64ToHex(jwk.x ?? "") };91126 }92-93-/**94- * Return the local sync identity keypair (public and private). Reserved95- * for the Phase-2 WebSocket sync coordinator that runs in the background.96- * Never surface the private key over a message handler.97- */98-export function deriveLocalSyncKeypair(masterKey: Uint8Array, deviceId: string) {99-  return deriveSyncIdentityKeypair(masterKey, deviceId);127+async function importSigningKey(seed: Uint8Array): Promise<CryptoKey> {128+  const prefix = Uint8Array.of(0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20);129+  const pkcs8 = new Uint8Array(prefix.length + 32);130+  pkcs8.set(prefix);131+  pkcs8.set(seed, prefix.length);132+  return crypto.subtle.importKey("pkcs8", pkcs8 as Uint8Array<ArrayBuffer>, { name: "Ed25519" }, true, ["sign"]);100133 }134+function base64ToHex(value: string): string {135+  const raw = atob(value.replace(/-/g, "+").replace(/_/g, "/"));136+  return Array.from(raw, (c) => c.charCodeAt(0).toString(16).padStart(2, "0")).join("");137+}138+export function deriveLocalSyncKeypair(_masterKey: Uint8Array, _deviceId: string) {139+  throw new Error("identity_migration_required");140+}101141 102142 function defaultDeviceName(): string {103143   // Best-effort browser + platform string. Avoids userAgent parsing — the@@ -124,36 +164,21 @@124164   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;125165 }126166 127-/**128- * The full local pairing identity plus its sync keypair, derived from the129- * stable ROOT key so pairing survives a master-password change. Callers own130- * the returned key material and must zero it.131- *132- * Lived in `code-pairing-bg.ts` until LAN code pairing was retired133- * (docs/sync-lan-retirement.md); it was never LAN-specific.134- */135167 export async function getLocalPairingIdentity(): Promise<{136168   identity: LocalIdentity;137169   privateKey: Uint8Array;138170   publicKey: Uint8Array;171+  signingPrivateKey: CryptoKey;139172 }> {140173   if (!isUnlocked()) throw new Error("vault_locked");141-  const masterKeyHex = getRootKeyHex();142-  if (!masterKeyHex) throw new Error("vault_locked");143-  const masterKey = new Uint8Array(masterKeyHex.length / 2);144-  for (let i = 0; i < masterKey.length; i++) {145-    masterKey[i] = parseInt(masterKeyHex.slice(i * 2, i * 2 + 2), 16);146-  }174+  const rootHex = getRootKeyHex(); if (!rootHex) throw new Error("vault_locked");175+  const root = bytes(rootHex);147176   try {148-    const base = await buildLocalIdentity(masterKey);149-    const vaultId = await computeVaultId(masterKey);150-    const keys = deriveSyncIdentityKeypair(masterKey, base.deviceId);151-    return {152-      identity: { ...base, vaultId },153-      privateKey: keys.secretKey,154-      publicKey: keys.publicKey,155-    };156-  } finally {157-    masterKey.fill(0);158-  }177+    const record = await ensureRecord(root);178+    const privateKey = bytes(record.x25519PrivateKeyHex);179+    const publicKey = generateKeyPairFromSeed(privateKey).publicKey;180+    const signingPrivateKey = await importSigningKey(bytes(record.ed25519SeedHex));181+    const base = await buildLocalIdentity(root);182+    return { identity: { ...base, vaultId: await computeVaultId(root) }, privateKey, publicKey, signingPrivateKey };183+  } finally { root.fill(0); }159184 }

@@ -32,6 +32,13 @@3232 3333 const RECONCILE_INTERVAL_MS = 60_000;3434 35+interface MeshIdentity {36+  identity: Omit<SyncPeerIdentity, "longTermPrivateKey">;37+  privateKey: Uint8Array;38+  publicKey: Uint8Array;39+  signingPrivateKey?: CryptoKey;40+}41+3542 interface WaiterHandle {3643   abort: AbortController;3744 }@@ -179,7 +186,7 @@179186     if (isDecoyMode()) return;180187     if (!current || !isRouteCapableMeshPeer(current)) return;181188     let session: Awaited<ReturnType<typeof openRelaySyncResponderSession>> | null = null;182-    let local: Awaited<ReturnType<typeof getLocalPairingIdentity>> | null = null;189+    let local: MeshIdentity | null = null;183190     let succeeded = false;184191     try {185192       local = await getMeshIdentity();@@ -229,6 +236,7 @@229236   identity: Omit<SyncPeerIdentity, "longTermPrivateKey">;230237   privateKey: Uint8Array;231238   publicKey: Uint8Array;239+  signingPrivateKey?: CryptoKey;232240 } | null> {233241   if (isUnlocked()) return getLocalPairingIdentity();234242   const cached = await getLockedSyncIdentity();

@@ -21,7 +21,7 @@2121       "SETUP_PIN", "DISABLE_PIN", "FIRE_CANARY_PING", "ACTIVATE_LICENSE", "GET_LICENSE", "GET_LICENSE_KEY",2222       "IS_DURESS_ENABLED", "SETUP_DURESS", "DISABLE_DURESS", "VERIFY_MAIN_PASSWORD", "CHANGE_PASSWORD",2323       "GET_SITE_PASSWORD_POLICY", "GET_LOCAL_IDENTITY", "LIST_PAIRED_DEVICES", "RENAME_PAIRED_DEVICE",24-      "UNPAIR_DEVICE", "RENAME_LOCAL_DEVICE", "START_ADOPTION_SOURCE", "START_ADOPTION_RECEIVER",24+      "UNPAIR_DEVICE", "RENAME_LOCAL_DEVICE", "LIST_PENDING_ADOPTION_HOLDERS", "REMOVE_PENDING_ADOPTION_HOLDER", "START_ADOPTION_SOURCE", "START_ADOPTION_RECEIVER",2525       "CANCEL_ADOPTION_SOURCE", "SOURCE_SAS_DECISION", "RECEIVER_SAS_DECISION", "ADOPTION_SOURCE_SAS", "ADOPTION_SOURCE_RESULT",2626       "TRIGGER_SYNC", "GET_SYNC_STATE", "GET_SYNC_SETTINGS", "SET_SYNC_SETTINGS", "GET_PENDING_PASSKEY",2727       "APPROVE_PASSKEY", "DENY_PASSKEY", "GET_PASSKEY_PROVIDER_STATE", "SET_PASSKEY_PROVIDER_ENABLED",

@@ -56,6 +56,8 @@5656   RENAME_LOCAL_DEVICE: "extension-page-only",5757   START_ADOPTION_SOURCE: "extension-page-only",5858   START_ADOPTION_RECEIVER: "extension-page-only",59+  LIST_PENDING_ADOPTION_HOLDERS: "extension-page-only",60+  REMOVE_PENDING_ADOPTION_HOLDER: "extension-page-only",5961   CANCEL_ADOPTION_SOURCE: "extension-page-only",6062   SOURCE_SAS_DECISION: "extension-page-only",6163   RECEIVER_SAS_DECISION: "extension-page-only",

@@ -97,6 +97,10 @@9797   startRelayAdoptionSource,9898 } from "./relay-adoption-bg";9999 import {100+  listPendingAdoptionHolders,101+  removePendingAdoptionHolder,102+} from "./pending-adoption-holder";103+import {100104   getSyncSettings,101105   setRelayUrl,102106   setSyncMode,@@ -1727,6 +1731,15 @@17271731         }17281732         return { ok: resolveSourceSasConfirmation(payload.id, payload.ok) };17291733       }1734+      case "LIST_PENDING_ADOPTION_HOLDERS": {1735+        return { ok: true, data: await listPendingAdoptionHolders() };1736+      }1737+1738+      case "REMOVE_PENDING_ADOPTION_HOLDER": {1739+        await removePendingAdoptionHolder();1740+        return { ok: true };1741+      }1742+17301743 17311744       case "CANCEL_ADOPTION_SOURCE": {17321745         cancelRelayAdoptionSource();

@@ -76,8 +76,9 @@7676 async function writePairedDevicesRaw(devices: PairedDevice[]): Promise<void> {7777   await chrome.storage.local.set({7878     [REGISTRY_KEY]: devices.map((device) => {79-      if (!isValidSecret(device.rendezvousSecretHex)) return device;80-      const scrubbed = { ...device };79+      const normalized = withSigningKeyHistory(device);80+      if (!isValidSecret(normalized.rendezvousSecretHex)) return normalized;81+      const scrubbed = { ...normalized };8182       delete scrubbed.rendezvousSecretHex;8283       return scrubbed;8384     }),@@ -193,6 +194,14 @@193194     throw new Error("device_identity_immutable");194195   }195196 }197+function withSigningKeyHistory(device: PairedDevice): PairedDevice {198+  if (!device.signingPublicKeyHex || !device.signingKeyHistory?.length) return device;199+  const current = device.signingPublicKeyHex.toLowerCase();200+  const history = device.signingKeyHistory201+    .filter((key) => Number.isInteger(key.version) && key.version > 0 && /^[0-9a-f]{64}$/i.test(key.publicKeyHex))202+    .map((key) => ({ version: key.version, publicKeyHex: key.publicKeyHex.toLowerCase() }));203+  return { ...device, signingKeyHistory: [...history.filter((key) => key.publicKeyHex !== current), { version: history.find((key) => key.publicKeyHex === current)?.version ?? history.reduce((max, key) => Math.max(max, key.version), 0) + 1, publicKeyHex: current }] };204+}196205 197206 export async function renamePairedDevice(deviceId: string, name: string): Promise<void> {198207   const alias = name.trim();@@ -342,20 +351,32 @@342351 }343352 344353 /**345- * Clear a revocation. The ONLY legitimate caller is a direct, SAS-confirmed346- * re-pair — a physically present user on both devices. Never call this from347- * a path a remote peer can reach.354+ * Clear a revocation after an authenticated, SAS-confirmed direct re-pair.355+ * A changed signing key is accepted only through this seam and the old key356+ * remains in immutable history.348357  */349358 export async function upsertPairedDeviceAndClearRevocation(device: PairedDevice): Promise<void> {350-  if (!device.deviceId) throw new Error("device.deviceId is required");351-  if (!device.longTermPublicKeyHex) throw new Error("device.longTermPublicKeyHex is required");352-  if (!device.deviceName) throw new Error("device.deviceName is required");353-  if (!device.deviceType) throw new Error("device.deviceType is required");359+  if (!device.deviceId || !device.longTermPublicKeyHex || !device.deviceName || !device.deviceType) {360+    throw new Error("invalid paired device");361+  }354362   await enqueueDeviceMutation(async () => {355363     const devices = await listPairedDevicesRaw();356364     const stored = devices.find((candidate) => candidate.deviceId === device.deviceId);357365     const incoming = { ...device, deviceName: capDeviceName(device.deviceName!) };358-    if (stored) assertIdentityBinding(stored, incoming);366+    if (stored) {367+      if (stored.longTermPublicKeyHex && incoming.longTermPublicKeyHex &&368+          !constantTimeEqualHex(stored.longTermPublicKeyHex, incoming.longTermPublicKeyHex)) {369+        throw new Error("device_identity_immutable");370+      }371+      if (stored.signingPublicKeyHex && incoming.signingPublicKeyHex &&372+          !constantTimeEqualHex(stored.signingPublicKeyHex, incoming.signingPublicKeyHex)) {373+        incoming.signingKeyHistory = [374+          ...(stored.signingKeyHistory ?? []),375+          { version: (stored.signingKeyHistory?.reduce((m, k) => Math.max(m, k.version), 0) ?? 0) + 1,376+            publicKeyHex: stored.signingPublicKeyHex.toLowerCase() },377+        ];378+      }379+    }359380     const index = devices.findIndex((candidate) => candidate.deviceId === device.deviceId);360381     if (index >= 0) {361382       const merged = { ...devices[index], ...incoming };

@@ -21,9 +21,12 @@2121   rollbackVault: vi.fn(),2222   createSyncAdapter: vi.fn(),2323   __applyIncomingDeviceManifest: vi.fn(),24-  storageSet: vi.fn(),2524   releaseAutoLock: vi.fn(),2625   deferAutoLock: vi.fn(),26+  storage: new Map<string, string>(),27+  storageSet: vi.fn(),28+  storageGet: vi.fn(),29+  storageRemove: vi.fn(),2730   sasDecisions: [] as Array<{ id: string; ok: boolean }>,2831 }));2932 @@ -103,8 +106,20 @@103106 104107 vi.mock("../shared/storage", () => ({105108   storageSet: mocks.storageSet,109+  storageGet: mocks.storageGet,110+  storageRemove: mocks.storageRemove,111+  storageClear: vi.fn(async () => mocks.storage.clear()),106112 }));107-113+const chromeStorage = {114+  local: {115+    get: async (key: string) => ({ [key]: await mocks.storageGet(key) }),116+    set: async (items: Record<string, string>) => {117+      for (const [key, value] of Object.entries(items)) await mocks.storageSet(key, value);118+    },119+    remove: async (key: string) => mocks.storageRemove(key),120+    clear: async () => mocks.storage.clear(),121+  },122+};108123 vi.mock("./paired-devices", () => ({109124   upsertPairedDevice: mocks.upsert,110125   upsertPairedDeviceAndClearRevocation: mocks.upsert,@@ -192,6 +207,17 @@192207   mocks.releaseAutoLock.mockReset();193208   mocks.deferAutoLock.mockReset();194209   mocks.deferAutoLock.mockReturnValue(mocks.releaseAutoLock);210+  mocks.storage.clear();211+  mocks.storageSet.mockReset();212+  mocks.storageSet.mockImplementation(async (key: string, value: string) => {213+    mocks.storage.set(key, value);214+  });215+  mocks.storageGet.mockReset();216+  mocks.storageGet.mockImplementation(async (key: string) => mocks.storage.get(key) ?? null);217+  mocks.storageRemove.mockReset();218+  mocks.storageRemove.mockImplementation(async (key: string) => {219+    mocks.storage.delete(key);220+  });195221   mocks.isProUser.mockReset();196222   mocks.isProUser.mockResolvedValue(true);197223   mocks.getLicenseKey.mockReset();@@ -210,7 +236,7 @@210236   mocks.getRootKeyHex.mockReturnValue("c".repeat(64));211237   mocks.upsert.mockResolvedValue(undefined);212238   mocks.setPairSecret.mockResolvedValue(undefined);213-    const applyIncomingDeviceManifest = vi.fn(async () => undefined);239+  const applyIncomingDeviceManifest = vi.fn(async () => undefined);214240     mocks.__applyIncomingDeviceManifest = applyIncomingDeviceManifest;215241     mocks.createSyncAdapter.mockReturnValue({216242       buildEntryManifest: vi.fn(async () => ({})),@@ -281,6 +307,7 @@281307     Object.defineProperty(globalThis, "chrome", {282308       configurable: true,283309       value: {310+        storage: chromeStorage,284311         runtime: {285312           async sendMessage(message: { type: string; payload: unknown }) {286313             mocks.pushes.push(message);@@ -560,8 +587,8 @@560587     mocks.openSocket.mockResolvedValue(socket);561588 562589     Object.defineProperty(globalThis, "chrome", {563-      configurable: true,564590       value: {591+        storage: chromeStorage,565592         runtime: {566593           sendMessage(message: { type: string; payload: unknown }) {567594             mocks.pushes.push(message);@@ -623,7 +650,9 @@623650     mocks.rollbackVault.mockReset();624651     mocks.rollbackVault.mockResolvedValue(undefined);625652     mocks.storageSet.mockReset();626-    mocks.storageSet.mockResolvedValue(undefined);653+    mocks.storageSet.mockImplementation(async (key: string, value: string) => {654+      mocks.storage.set(key, value);655+    });627656     mocks.upsert.mockReset();628657     mocks.upsert.mockResolvedValue(undefined);629658     mocks.setPairSecret.mockReset();@@ -632,8 +661,8 @@632661     mocks.triggerSync.mockResolvedValue(undefined);633662     mocks.openSocket.mockResolvedValue(socketWithFrames([]));634663     Object.defineProperty(globalThis, "chrome", {635-      configurable: true,636664       value: {665+        storage: chromeStorage,637666         runtime: {638667           async sendMessage(message: { type: string; payload?: unknown }) {639668             mocks.pushes.push({ type: message.type, payload: message.payload });@@ -717,8 +746,8 @@717746 718747     const { startRelayAdoptionReceiver } = await import("./relay-adoption-bg");719748     Object.defineProperty(globalThis, "chrome", {720-      configurable: true,721749       value: {750+        storage: chromeStorage,722751         runtime: {723752           async sendMessage(message: { type: string; payload?: unknown }) {724753             mocks.pushes.push({ type: message.type, payload: message.payload });@@ -788,8 +817,8 @@788817 789818     // Replace the chrome.runtime mock for this one test and approve the displayed SAS.790819     Object.defineProperty(globalThis, "chrome", {791-      configurable: true,792820       value: {821+        storage: chromeStorage,793822         runtime: {794823           async sendMessage(message: { type: string; payload?: unknown }) {795824             mocks.pushes.push({ type: message.type, payload: message.payload });

@@ -40,6 +40,11 @@4040   getLocalPairingIdentity,4141   rotateDeviceId,4242 } from "./device-identity";43+import {44+  hasAdoptionIdentityConflict,45+  markLastSyncedAt,46+  upsertPairedDeviceAndClearRevocation,47+} from "./paired-devices";4348 import { getSyncSettings, relayInForce } from "./sync-settings";4449 import { activateLicense, getLicenseKey, isProUser } from "./license";4550 import { createVaultFromRootKey, exportDuressSlotForAdoption, getRootKeyHex, installAdoptedDuressSlot, isUnlocked, rollbackAdoptedVault } from "./vault";@@ -47,7 +52,11 @@4752 import { computeVaultId } from "../shared/sync-identity";4853 import { INITIAL_SYNC_PENDING_DEVICE_KEY } from "../shared/initial-sync";4954 import { storageRemove, storageSet } from "../shared/storage";50-import { markLastSyncedAt, upsertPairedDeviceAndClearRevocation, hasAdoptionIdentityConflict } from "./paired-devices";55+import {56+  persistPendingAdoptionHolder,57+  readPendingAdoptionHolder,58+  removePendingAdoptionHolder,59+} from "./pending-adoption-holder";5160 import { isValidPairSecret, setPairSecret } from "./pair-secrets";5261 import { createSyncVaultAdapter } from "./sync-vault-adapter";5362 import { triggerSyncIfReachable } from "./sync-trigger";@@ -290,7 +299,16 @@290299         derivePairingSAS(session.handshakeHash),291300         crypto.randomUUID(),292301       ),293-      upsertPairedDevice: storeAdoptedDevice,302+      persistPendingHolder: persistPendingAdoptionHolder,303+      clearPendingHolder: async (adoptRequest) => {304+        const current = await readPendingAdoptionHolder();305+        if (current?.request.device_id === adoptRequest.device_id) {306+          await removePendingAdoptionHolder();307+        }308+      },309+      async upsertPairedDevice(paired) {310+        await storeAdoptedDevice(paired);311+      },294312       hasDeviceIdentityCollision: async (device) =>295313         hasAdoptionIdentityConflict(device.deviceId, device.longTermPublicKeyHex ?? ""),296314       rotateSourceIdentity: async () => {

@@ -153,7 +153,7 @@153153         deviceId: "p",154154         version: 0,155155         deviceTime: Date.now(),156-        protocolVersion: 2,156+        protocolVersion: 3,157157       });158158       await peer.receive(); // our manifest159159       await peer.send({ type: "SYNC_MANIFEST", entries: {}, tombstones: {} });@@ -193,7 +193,7 @@193193         deviceId: "p",194194         version: 0,195195         deviceTime: Date.now(),196-        protocolVersion: 2,196+        protocolVersion: 3,197197       });198198       await peer.receive(); // our manifest199199       await peer.send({ type: "SYNC_MANIFEST", entries: {}, tombstones: {} });@@ -225,7 +225,7 @@225225         deviceId: "p",226226         version: 0,227227         deviceTime: Date.now(),228-        protocolVersion: 2,228+        protocolVersion: 3,229229       });230230       await peer.receive();231231       const entries = Object.fromEntries(@@ -248,7 +248,7 @@248248         deviceId: "p",249249         version: 0,250250         deviceTime: Date.now(),251-        protocolVersion: 2,251+        protocolVersion: 3,252252       });253253       await tombstonePeer.receive();254254       const tombstones = Object.fromEntries(@@ -278,7 +278,7 @@278278       expect(sentHello.deviceTime).toBeGreaterThan(0);279279     }280280     // Send a mismatched vaultId to abort early so the test doesn't hang.281-    await peer.send({ type: "SYNC_HELLO", vaultId: "different-vault", deviceId: "p", version: 7, deviceTime: Date.now(), protocolVersion: 2 });281+    await peer.send({ type: "SYNC_HELLO", vaultId: "different-vault", deviceId: "p", version: 7, deviceTime: Date.now(), protocolVersion: 3 });282282     await peer.receive(); // SYNC_ERROR283283     await initPromise;284284   });@@ -313,7 +313,7 @@313313     const [dialerSession, waiterSession] = symmetricSessionPair();314314     const dialerManifest = {315315       body: {316-        manifestVersion: 3,316+        manifestVersion: 5,317317         issuerDeviceId: "dialer",318318         issuedAt: 1,319319         devices: [],@@ -323,7 +323,7 @@323323     } satisfies SignedDeviceManifest;324324     const waiterManifest = {325325       body: {326-        manifestVersion: 3,326+        manifestVersion: 5,327327         issuerDeviceId: "waiter",328328         issuedAt: 1,329329         devices: [],@@ -424,7 +424,7 @@424424       deviceId: "p",425425       version: 3, // different version so exchange proceeds426426         deviceTime: Date.now() - 200_000,427-        protocolVersion: 2,427+        protocolVersion: 3,428428       });429429     // Yield so the coordinator's async continuation can run the clock-skew check.430430     await new Promise((r) => setTimeout(r, 0));@@ -507,7 +507,7 @@507507     const peerProtocol = (async () => {508508       const hello = await peer.receive();509509       expect(hello.type).toBe("SYNC_HELLO");510-      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "device-peer", version: 3, deviceTime: Date.now(), protocolVersion: 2 });510+      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "device-peer", version: 3, deviceTime: Date.now(), protocolVersion: 3 });511511 512512       const ourManifest = await peer.receive();513513       expect(ourManifest.type).toBe("SYNC_MANIFEST");@@ -566,7 +566,7 @@566566     const peerProtocol = (async () => {567567       const hello = await peer.receive();568568       expect(hello.type).toBe("SYNC_HELLO");569-      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-B", deviceId: "evil", version: 3, deviceTime: Date.now(), protocolVersion: 2 });569+      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-B", deviceId: "evil", version: 3, deviceTime: Date.now(), protocolVersion: 3 });570570       // Peer should receive a SYNC_ERROR and we should stop.571571       const err = await peer.receive();572572       expect(err.type).toBe("SYNC_ERROR");@@ -623,7 +623,7 @@623623     const initPromise = runSyncInitiator(session, vault);624624     const peerProtocol = (async () => {625625       await peer.receive(); // hello626-      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 2, deviceManifestVersion: 4 });626+      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 3, deviceManifestVersion: 5 });627627       await peer.receive(); // manifest628628       await peer.send({ type: "SYNC_MANIFEST", entries: {}, tombstones: {} });629629       await peer.receive(); // request@@ -660,7 +660,7 @@660660     const initPromise = runSyncInitiator(session, vault);661661     const peerProtocol = (async () => {662662       await peer.receive();663-      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 2, deviceManifestVersion: 4 });663+      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 3, deviceManifestVersion: 5 });664664       await peer.receive();665665       await peer.send({ type: "SYNC_MANIFEST", entries: {}, tombstones: {} });666666       await peer.receive();@@ -688,7 +688,7 @@688688     const initPromise = runSyncInitiator(session, vault);689689     void (async () => {690690       await peer.receive(); // hello691-      await peer.send({ type: "SYNC_HELLO", vaultId: "v", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 2 });691+      await peer.send({ type: "SYNC_HELLO", vaultId: "v", deviceId: "p", version: 3, deviceTime: Date.now(), protocolVersion: 3 });692692       await peer.receive(); // our manifest693693       await peer.send({ type: "SYNC_DONE" }); // wrong frame694694     })();@@ -711,7 +711,7 @@711711     const initPromise = runSyncInitiator(session, vault);712712     void (async () => {713713       await peer.receive(); // hello714-      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 5, deviceTime: Date.now(), protocolVersion: 2 });714+      await peer.send({ type: "SYNC_HELLO", vaultId: "vault-abc", deviceId: "p", version: 5, deviceTime: Date.now(), protocolVersion: 3 });715715       await peer.receive(); // manifest716716       await peer.send({ type: "SYNC_MANIFEST", entries: {}, tombstones: {} });717717       await peer.receive(); // request

@@ -121,7 +121,7 @@121121     deviceId: "peer-device",122122     version: 0,123123     deviceTime: Date.now(),124-    protocolVersion: 2,124+    protocolVersion: 3,125125   });126126   const manifest = await peer.receive();127127   if (manifest.type !== "SYNC_MANIFEST") throw new Error("expected MANIFEST");@@ -355,7 +355,7 @@355355           deviceId: "peer-device",356356           version: 0,357357           deviceTime: Date.now(),358-          protocolVersion: 2,358+          protocolVersion: 3,359359         });360360       }361361     })().catch(() => undefined);